Reconcile purge against remote by hashed key, not human ID #183

Merged
clawbot merged 1 commits from issue-160-purge-reconcile-by-remote-key into next 2026-09-22 12:11:49 +02:00
Collaborator

Fixes #160.

syncWithRemote, which purge runs before deleting anything, built its set of remote snapshots from the hashed metadata/<key>/ directory names but then compared each local row's human snapshot ID against that set. A human ID never equals a hashed key, so the reconcile deleted every local snapshot record; the purge that followed then found nothing to delete and removed nothing from the remote. Retention never took effect and the store grew unbounded.

The reconcile now uses listAllRemoteSnapshotKeys() and compares snapshot.RemoteSnapshotKey(id), the same correct logic CleanupLocalSnapshots already uses; it is kept as its own quiet function (no stdout prose) so --prune output stays clean.

The existing purge tests passed only because their stubs used a metadata/<human-id>/ layout production never writes. The setup helper now writes stubs under the hashed remote key. Two new tests cover the invariant: remotely-backed local rows survive the reconcile, and a purge removes the local row and the remote metadata together (or leaves both).

make check passes.

Model: opus-4-8

Fixes https://git.eeqj.de/sneak/vaultik/issues/160. `syncWithRemote`, which purge runs before deleting anything, built its set of remote snapshots from the hashed `metadata/<key>/` directory names but then compared each local row's human snapshot ID against that set. A human ID never equals a hashed key, so the reconcile deleted every local snapshot record; the purge that followed then found nothing to delete and removed nothing from the remote. Retention never took effect and the store grew unbounded. The reconcile now uses `listAllRemoteSnapshotKeys()` and compares `snapshot.RemoteSnapshotKey(id)`, the same correct logic `CleanupLocalSnapshots` already uses; it is kept as its own quiet function (no stdout prose) so `--prune` output stays clean. The existing purge tests passed only because their stubs used a `metadata/<human-id>/` layout production never writes. The setup helper now writes stubs under the hashed remote key. Two new tests cover the invariant: remotely-backed local rows survive the reconcile, and a purge removes the local row and the remote metadata together (or leaves both). `make check` passes. Model: opus-4-8
clawbot added 1 commit 2026-09-22 11:56:24 +02:00
syncWithRemote compared human snapshot IDs against the hashed
metadata/<key>/ directory names, which never match, so it deleted every
local snapshot record; the purge that followed then found nothing to
remove remotely. Reconcile via listAllRemoteSnapshotKeys and
RemoteSnapshotKey(id), matching CleanupLocalSnapshots, so a row still
backed by remote metadata is kept.

The purge tests only passed because their stubs used the human-ID layout
production never writes; they now write metadata under the hashed remote
key. New tests prove remotely-backed local rows survive the reconcile and
that a purge removes the local row and remote metadata together.

Model: opus-4-8
clawbot added the needs-review label 2026-09-22 11:56:31 +02:00
clawbot self-assigned this 2026-09-22 11:56:31 +02:00
Author
Collaborator

PASS

Model: opus-4-8

PASS Model: opus-4-8
clawbot merged commit 96ebcd40d7 into next 2026-09-22 12:11:49 +02:00
clawbot deleted branch issue-160-purge-reconcile-by-remote-key 2026-09-22 12:11:49 +02:00
Sign in to join this conversation.